Method of authenticating a terminal in a transaction execution system

• US 5,475,756 A
• Filed: 02/17/1994
• Issued: 12/12/1995
• Est. Priority Date: 02/17/1994
• Status: Expired due to Fees

• Current Assignee: American Telephone & Telegraph Company (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Merritt, Michael J.
• Primary Examiner(s): Buczinski, Stephen C.
• Application Number:
  US08/198,800
• Time in Patent Office: 663 Days
• Field of Search: 380/23-25, 340/825.34
• US Class Current: 705/73
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

The invention provides for a method of authenticating to a user or customer a terminal, such as an automatic teller machine, in a transaction execution system. The terminal is authenticated by a central host using cryptographic techniques, and a personal security phrase is sent from the host to the terminal. A message, incorporating the personal security phrase, is communicated to the customer by the terminal, thereby indicating that the terminal is legitimate. The terminal is authenticated to the customer prior to his entering any secret or confidential information, such as a personal identification number, into the terminal.

Claims

1. A method of authenticating a terminal in a transaction execution system to a user, said method comprising the steps of:

receiving account information in said terminal;

contacting through a communication line a host associated with an institution that issued said account information;

sending at least a portion of said account information from said terminal to said host;

sending a personal security phrase, corresponding to said account, from said host to said terminal; and

communicating to said user at said terminal a message incorporating said personal security phrase, where the aforementioned steps occur prior to said user'"'"'s entering any secret or confidential information into said terminal.

2. The method of claim 1 wherein the step of communicating a message incorporating said personal security phrase includes the step of displaying said personal security phrase on a presentation module connected to said terminal.

3. The method of claim 2 wherein the step of sending a personal security phrase includes the step of sending a personal security phrase having the form of a plurality of alpha-numeric characters.

4. The method of claim 3 wherein the step of sending a personal security phrase further includes the step of sending a personal security phrase having the form of a plurality of words.

5. The method of claim 2 wherein the step of sending a personal security phrase further includes the step of sending a personal security phrase having the form of a video image.

6. The method of claim 2 wherein the step of sending a personal security phrase further includes the step of sending a personal security phrase having the form of a sequence of video images.

7. The method of claim 1 wherein

the step of sending a personal security phrase includes the step of sending a personal security phrase having the form of recorded sound;

and

the step of communicating a message incorporating said personal security phrase includes the step of audibly communicating said personal security phrase through a presentation module connected to said terminal.

8. The method of claim 1 wherein said terminal is an automatic teller machine.

9. The method of claim 8 wherein the aforementioned steps occur prior to said user'"'"'s entering a personal identification number into said automatic teller machine.

10. The method of claim 9 wherein the step of communicating a message incorporating said personal security phrase further includes the step of instructing said user to enter his personal identification number into said automatic teller machine only if said user recognizes said personal security phrase as his own.

11. The method of claim 1 further including the step of authenticating said terminal to said host, where the step of authenticating said terminal occurs prior to the step of sending a personal security phrase from said host to said terminal.

12. The method of claim 11 wherein the step of communicating a message incorporating said personal security phrase includes the step of displaying said personal security phrase on a presentation module connected to said terminal.

13. The method of claim 12 wherein the step of sending a personal security phrase includes the step of sending a personal security phrase having the form of a plurality of alpha-numeric characters.

14. The method of claim 13 wherein the step of sending a personal security phrase further includes the step of sending a personal security phrase having the form of a plurality of words.

15. The method of claim 12 wherein the step of sending a personal security phrase includes the step of sending a personal security phrase having the form of a video image.

16. The method of claim 12 wherein the step of sending a personal security phrase includes the step of sending a personal security phrase having the form of a sequence of video images.

17. The method of claim 11 wherein

the step of sending a personal security phrase includes the step of sending a personal security phrase having the form of recorded sound;

and

the step of communicating a message incorporating said personal security phrase includes the step of audibly communicating said personal security phrase through a presentation module connected to said terminal.

18. The method of claim 11 further including the step of authenticating said host to said terminal, where the step of authenticating said host occurs prior to the step of sending account information from said terminal to said host.

19. The method of claim 18 wherein said terminal is an automatic teller machine.

20. The method of claim 19 wherein the aforementioned steps occur prior to said user'"'"'s entering a personal identification number into said automatic teller machine.

21. The method of claim 19 wherein the step of communicating a message incorporating said personal security phrase further includes the step of instructing said user to enter his personal identification number into said automatic teller machine only if said user recognizes said personal security phrase as his own.

22. The method of claim 21 wherein the step of authenticating said automatic teller machine to said host includes the steps of:

sending a serial number associated with said automatic teller machine to said host;

generating a first random number in said host;

sending said first random number from said host to said automatic teller machine;

computing in said automatic teller machine an encryption of said serial number, said first random number, and a first direction code, using a first secure key stored in said automatic teller machine;

sending said encryption of said serial number, said first random number, and said first direction code, using said first secure key, from said automatic teller machine to said host;

computing in said host an encryption of said serial number, said first random number, and said first direction code using a second secure key stored in said host;

comparing in said host said encryption of said serial number, said first random number, and said first direction code, computed using said first key, to said encryption of said serial number, said first random number, and said first direction code, computed using said second key; and

verifying in said host that said encryption of said serial number, said first random number, and said first direction code, computed using said first key, and said encryption of said serial number, said first random number, and said first direction code, computed using said second key, are equal.

23. The method of claim 22 wherein the step of authenticating said host to said automatic teller machine includes the steps of:

generating a second random number in said automatic teller machine;

sending said second random number from said automatic teller machine to said host;

computing in said host an encryption of said serial number, said second random number, and a second direction code different from said first direction code, using said first key;

sending said encryption of said serial number, said second random number, and said second direction code, using said first key, from said host to said automatic teller machine;

computing in said automatic teller machine an encryption of said serial number, said second random number, and said second direction code, using said second key;

comparing in said automatic teller machine said encryption of said serial number, said second random number, and said second direction code, computed using said first key, to said encryption of said serial number, said second random number, and said second direction code, computed using said second key; and

verifying in said automatic teller machine that said encryption of said serial number, said second random number, and said second direction code, computed using said first key, and said encryption of said serial number, said second random number, and said second direction code, computed using said second key, are equal.